gitlab_member_role: GraphQL error "X is not a valid global id" when creating custom roles with permissions
Bug Report
When creating a gitlab_member_role resource with enabled_permissions, the following GraphQL error is returned:
Error: GitLab GraphQL error occurred
with gitlab_member_role.example,
on main.tf line X, in resource "gitlab_member_role" "example":
X: resource "gitlab_member_role" "example" {
Error 0 message: [PERMISSION_NAME] is not a valid global idRoot Cause
The Create (and likely Update) function in internal/provider/resource_gitlab_member_role.go builds the memberRoleCreate GraphQL mutation using raw string interpolation via fmt.Sprintf. The permissions field is a Go []string, which when formatted with %s produces [PERMISSION_ONE PERMISSION_TWO] — space-separated with no quotes and no commas.
GraphQL expects an enum list in the format [PERMISSION_ONE, PERMISSION_TWO]. The malformed input causes the GraphQL parser to attempt to interpret the value as a global ID type, resulting in the error "X is not a valid global id".
Relevant code (~line 305–340 of resource_gitlab_member_role.go):
var permissions []string
for _, v := range data.EnabledPermissions {
permissions = append(permissions, v.ValueString())
}
query := gitlab.GraphQLQuery{
Query: fmt.Sprintf(`
mutation {
memberRoleCreate(
input: {
...
permissions: %s // produces [PERM_A PERM_B], not [PERM_A, PERM_B]
}
) { ... }
}`, ..., permissions),
}Implementation Plan
- Follow the
CONTRIBUTING.mdguide for setting up your local development environment. - Clone the community fork of this project.
- In
internal/provider/resource_gitlab_member_role.go, amend all GraphQL queries to use GraphQL variables instead of string interpolation. - In
internal/provider/resource_gitlab_member_role_test.go, add or update a test so the first test step is creating a role with multiple permissions.
Relevant Terraform Configuration
resource "gitlab_member_role" "example" {
name = "Example Role"
base_access_level = "DEVELOPER"
group_path = "my-group"
enabled_permissions = [
"READ_CODE",
"ADMIN_MERGE_REQUEST",
]
}Relevant Log Output
Error: GitLab GraphQL error occurred
Error 0 message: READ_CODE is not a valid global idAdditional Details
- Upstream API: GitLab GraphQL
memberRoleCreatemutation - The error format
"Error %d Message: %s"in the provider matches the top-level GraphQLerrorsarray, confirming this is a schema/parse-level error, not a mutation-level validation error.
Edited by 🤖 GitLab Bot 🤖